Sign in to web apps

This section describes how to view and sign in to the web apps available in your User Portal.

Your system administrator can assign apps to you and configure them for single sign-on (SSO). This means you only have to sign in to your User Portal, then you can launch and sign in to assigned apps without entering additional credentials.

In addition, your system administrator can enable you to save your own applications to the User Portal for SSO.

Your admin might require MFA for some applications.

Mobile apps are deployed directly to your mobile device. For more details, see Install mobile apps deployed by your IT department.

View web apps

You can view your web apps from the Applications page of the User Portal. This page displays a button for each web app that your system administrator has assigned to you. If your Applications page is empty, no web apps have been assigned to you.

Each web app button may have one or more of the following symbols, indicating a status or restriction:

Symbol	Description
	Key: The app is tagged as a gateway application but you are not logged in from inside your corporate firewall.
	Blocked: You cannot open the app. Your IT administrator configures apps to control when you can access them. For example, an app can be configured so that you can only log in to it from the User Portal on your office computer, and not from outside the office.
	Jigsaw puzzle piece: You need to install CyberArk Identity Browser Extension to log in to the app with single sign-on. Install the Browser Extension on every computer you use to access the app. You only need to install the Browser Extension once for all apps with this requirement. For more details, see Manage credentials with Workforce Password Management. After you install the Browser Extension, the symbol is removed.
	Shared: No credentials are required to log in to this app. Your system administrator has configured the app to allow automatic authentication for all users, using the same login credentials.
	New: The app has been newly deployed by your system administrator. After you launch the app or access Application Settings, the symbol is removed.

You can define the default set of applications that display on the Apps page of the user portal.

To make sure that you see all of the web applications assigned to you, refresh your browser.

To set the default application filter:

Click the Settings gear icon to access the Settings and Preferences options.
Expand the Default Filter drop-down list, then select a tag.
Select a layout, size, and title option for the applications listed in the User Portal, then click Save.
Sign out and sign back in to the User Portal.
Confirm that the Apps page shows the expected filter in the Search drop-down box.

Sign in to web apps

You can sign in to web apps from the User Portal or the Browser Extension.

This section describes how to configure migrated generic apps to auto-fill credentials at launch.

If CyberArk Identity is configured to store application credentials in CyberArk PAM - Self-Hosted, then application credentials are stored and fetched from the PAM - Self-Hosted Vault.

Launch apps from the User Portal

From the User Portal, click an app button to launch the app in your default browser.

If it's the first time you are launching the app, you may need to enter your app user name and password. These credentials may differ from the credentials you use to sign in to the User Portal. CyberArk Identity stores your app credentials and automatically authenticates you the next time you launch the app.

If you are launching a shared app, multi-factor authentication may be required.

Launch apps from the Browser Extension

You can launch apps from your Browser Extension, without opening the User Portal.

Click the Browser Extension button in your browser.
Find the app that you want to launch.

You can use the drop-down menu to filter apps, or the search bar to search for a specific app by name.
Click the app name in the list.

Configure a generic app to auto-fill credentials at launch

The following procedure is applicable to PAM - Self-Hosted business users that have migrated their business application accounts to the Identity User Portal, but the apps were migrated as generic username and password apps.

In this scenario, you can launch an app, but CyberArk Identity will not autofill the credentials. To configure the app to autofill credentials at launch, use the Land & Catch function of the Browser Extension, as described below.

For the following procedures, your system administrator must enable Land & Catch in the Browser Extension.

In the User Portal, locate the generic app and click the Application Settings button.
Copy the user name and password from the User Identity fields.
Launch the app website and manually paste the copied credentials into the user name and password fields.
Use the Land & Catch feature to add the app to the User Portal. For more details, see Add an app to your User Portal with Land & Catch.

You can now see two application buttons for the same application in the User Portal.
As the generic app is no longer needed, you can delete it. Go to Application Settings > Delete this app? and click Yes.

Update your user identity for a web app

If you change your user name or password after an app is deployed to the User Portal, you need to update your user identity in order to continue using single sign-on.

When you update your user identity for an app on the User Portal, it automatically synchronizes with the CyberArk Identity mobile app.

To update your user identity for an app:

In the User Portal, click Applications.
Find the app and click the gear button to open Application Settings.
Under User Identity, enter the user name and password for the app.
- To copy your user name or password to your clipboard, click Copy next to the field.
- To see your password, click the eye button next to the field.
You may not have these options if your system administrator has disabled them.
Click Save.

Install mobile apps deployed by your IT department

This topic describes how to install mobile apps that are deployed directly to your mobile device for automatic installation.

Your IT department can deploy iOS native applications directly to your device. After you enroll the device, it prompts you to install each application. You can install the application right away, or at a later time:

To install the application right away, tap Install and follow the instructions. For applications you are installing from the Apple App Store, you are also prompted to enter your Apple ID and password.
To install the application at a later time, use the Company Apps application. For more details, see Install mobile applications using Company Apps.

Request app access

You can request access to apps that your administrator has configured with a “request and approval” workflow. You do not need any special privileges to make requests.

Sign in to the Identity User Portal.
Go to Applications and click Add Apps.
In the app catalog, find the app you want to request and click Request.

The Request button is only available for apps that have the "request and approval" workflow enabled.

Select Permanent or Windowed in the Assignment Type drop-down menu.

Assignment type	Description
Permanent	If the request is granted, you will have access to the app for an indefinite time period, or until it is revoked by an administrator.
Windowed	If the request is granted, you will have access to the app for the specified window, or until it is revoked by an administrator.

(Optional) For a Windowed assignment type, select a start and end date and time.
Type the business reason for your request and click Submit. An email notification is sent directly to the designated approver.

You can now click the Requests tab in the User Portal to see the status of your request.

When you request is approved or rejected, you receive an email notification. If your request is approved, the email includes a link to open the User Portal.

View request details

You can view the status and history of your requests in the User Portal.

If you have the appropriate administrative rights, you can also view requests in the Identity Administration portal.

The Requests tab is only available if you have made a request, or if you are a designated approver for a request.

The Requests tab includes the following information about each request:

Name	Description
Description	A brief summary of the request, including the type of access or app requested.
Status	The current status of the request, either Pending, Approved, Rejected, or Failed. You can review the request details to see why the request failed. A request may fail for one of the following reasons: If the email address for the approver or requester is invalid. If the request duration has expired. For example, if a request to use the `root` account was approved for a duration of 60 minutes, and the requester did not login to use the account within 60 minutes.
Posted	The date and time of the most recent request activity.
Approver	If the request is pending, this is the user or role designated to approve the request. If the request is resolved, this is the user who approved or rejected the request.
Requester	The user who submitted the request.
Latest Log Entry	The most recent information recorded for the request.

Remove web apps

You can remove web apps from CyberArk Identity if you added them from the App Catalog or App Capture. You cannot remove apps that were assigned to you by your IT department.

To remove a web app:

Open the User Portal and click Applications.
Find the app and click the gear button to open the Application Settings window.
Click Delete this app?.

If you do not see an option to delete an app, the app was deployed by your IT department and you cannot remove it.
Click Yes to finish.

Organize web apps

You can organize the layout of the web apps in your User Portal.

By default, the Applications page lists all of your web apps. You can change the layout and organization of the User Portal with built-in filters and user-defined tags.

Manage tags

You can create your own tags for organizing apps.

For example, you could create one tag for cloud storage apps and another tag for travel apps. You could also create a tag called "favorites", so you can easily find your most used apps.

Create and assign a tag

You can create and assign tags from the Application Settings window.

Find the app you want to configure and click the gear button to open the Application Settings window.
In the Tags field, select an existing tag using the drop-down menu or start typing to create a new tag.

An app can have multiple tags. If you want to assign another tag to the app, repeat this step.
Click Save.

Repeat this procedure for every app that you want to tag.

Tags that you create in Application Settings override the default app grouping defined by your system administrator.

Remove a tag from an app

Find the app you want to configure and click the gear button to open the Application Settings window.
In the Add Tags field, click X for the tag that you want to delete.
Click Save.

If you delete all tags from an app, the app reverts to the default grouping defined by your system administrator.

Change the app layout

You can change the layout of your apps, to make it easier to find the apps you want to launch. For example, you can change the default app filter and display the filtered apps in groups.

To change the app layout:

Click the Settings button.

In the Settings and Preferences window, update your settings and preferences, then click Save.

App Settings and Preferences window settings description
Setting	Description
Default Filter	Change the default filter for the next time you log in to the User Portal.
App Layout	Change the app layout between Grouped and Grid. Grouped organizes apps according to categories created by either your user tags or your admin. See Create and assign a tag for more information about user tags. Grid shows all apps in a grid layout.
Icon Size	Change the size of the app button icons.
App Title	Show or hide the app titles.